I'm implementing a JWT Bearer Token within Salesforce (Apex) so my customers can passwordlessly login to a community. Not sure if it is a good practice, but I done some research and saw some use cases like this.
For the JWT Flow I am using the following code (followed this doc):
String token_endpoint = 'https://community-domain.cs101.force.com' + '/services/oauth2/token';
Auth.JWT jwt = new Auth.JWT();
jwt.setIss('3MVG9K...Hhe');
jwt.setSub('[email protected]');
jwt.setAud('https://community-domain.cs101.force.com');
Auth.JWS jws = new Auth.JWS(jwt, 'Cert_Unique_Id');
Auth.JWTBearerTokenExchange bearer = new Auth.JWTBearerTokenExchange(token_endpoint, jws);
System.debug(bearer);
String accessToken = bearer.getAccessToken();
Considerations that may be imporatant:
Joe Doe is a Customer User (Customer Community Plus License)
Connected App has these scopes: api, web, full, refresh_token, offline_access
Permitted users: Admin approved users are pre-authorized
Working on a Sandbox
When I execute this code on anonymous console, I get:
Auth.JWTBearerTokenExchange.JWTBearerTokenExchangeException: Error 400: {"error":"invalid_grant","error_description":"authentication failure"}
And in the user login history I get "Status: Failed: Invalid Token".
I googled around a lot but I didn't find anyone having the exact same thing.
Has anyone gone through the same problem?
I tried using http://mydomain.my.salesforce.com as token_endpoint and http://test.salesforce.com as audience (on setAud). It works but it doesn't actually gives me access to community, only to Salesforce itself.